x402-lab — Test AI-Agent Payments Before They Cost Real Money

Problem

AI agents can now pay for APIs over x402 (HTTP 402) in USDC, but there is no safe place to test it. Every try on a testnet or mainnet facilitator needs a funded wallet, a facilitator can verify a payment and still fail to settle it, and failures come back as opaque codes like invalid_exact_evm_transaction_simulation_failed.

Business Impact

x402 lets AI agents pay for APIs per request, and a payment bug either takes the buyer's money or the seller's revenue. Testing it today means a funded wallet and real settlements. x402-lab makes that loop free and local, and it catches the failure that hurts most: while building it, rate-limited receipt polling made the stock stack charge the agent and still answer 402. Conformance check C04 flags that by comparing the response with on-chain balances.

System Approach

• One command (x402-lab dev) boots Anvil, an EIP-3009 test USDC, Multicall3, the official @x402/evm facilitator, an @x402/hono paid API and the dashboard in about a second; a local payment settles in ~170 ms
• Route-map dashboard: every request is drawn as a train from the agent to the chain, and failures exit down branch lines to counted termini with the last reason
• Five chaos modes inside the facilitator: settle-fail, rpc-rate-limit (settlement_pending), hang, latency and flaky
• 35 conformance checks across the resource server, the chain and the facilitator, runnable against the lab or any paid endpoint, with JSON output and a non-zero exit code for CI
• Error decoder for 139 codes from the reference TypeScript, Go and Python SDKs and FiatToken reverts, plus schema checks for PAYMENT-* headers and JSON
• Programmatic API (Lab.start, runConformance) for test suites and GitHub Actions

Key Decisions & Trade-offs

• Test the official SDKs, never reimplement the protocol: @x402/core, @x402/evm, @x402/hono and @x402/fetch run as shipped
• LabUSDC mirrors USDC's EIP-712 domain and revert strings, so real x402 payloads verify and settle unchanged
• Multicall3 is installed on boot — without it the reference facilitator reports nonce, balance and token-domain failures as one generic simulation error
• Safe with real keys: negative tests sign with a throwaway key, and a real key signs one payment only for the named --asset, under --max-amount, on the --rpc chain, valid for at most 600 seconds
• The dashboard API only answers localhost Host and Origin headers and JSON requests, which blocks CSRF and DNS rebinding
• A zero-build vanilla JS dashboard, so the whole lab ships inside npx

Current Status

Public and open source (MIT) at github.com/rohitguta2432/x402-lab since October 17, 2026. 26 automated tests, including end-to-end runs that settle real EIP-3009 payments on Anvil, run in GitHub Actions. Install with npx github:rohitguta2432/x402-lab dev (Node 20+ and Foundry).

Roadmap

• Solana (SVM) lane next to the EVM one
• upto, Permit2 and ERC-7710 transfer methods
• Validator for origin-hosted discovery (/.well-known/x402.json)
• MCP server so coding agents can run the suite

What I'd Improve Next

• Publish to npm so the install becomes npx x402-lab
• Record and replay real facilitator traffic

Explore More

• MyFinancial — Personal Financial Advisor — Financial planning in India is fragmented across banks, insurance, and tax documents.
• PropCheck — AI Property Trust Score for India — Indian property buyers lose lakhs to fraudulent listings on Magicbricks, 99acres, Housing.
• StellarMIND — Chat-to-SQL with RAG — Business users need to query databases without knowing SQL.
• ClinicAI — WhatsApp AI Clinic Assistant — India has 12 lakh+ small clinics running on phone calls and paper diaries.
• MicroItinerary — AI Travel Planner — Travel apps optimize for proximity and ratings.
• SanatanApp — Hindu Devotional App — Devotional users in India juggle 5+ separate apps for Chalisa, Gita, Aarti, Ramayan, and Mahabharat.
• SynFlow — Enterprise Intelligence Platform — Private deal networks rely on manual introductions and spreadsheets.
• FinBaby (Jama) — Personal Finance Tracker — Indian middle-class families track expenses across UPI apps, bank statements, and paper notebooks.
• RetailOS — Multi-Tenant Retail SaaS — Indian kirana stores and small retailers use paper registers or basic billing software with no inventory tracking, no GST compliance, and no offline support.
• TripHive — Offline-First Collaborative Trip Planner — Group trip planning is fragmented across WhatsApp, Google Docs, Maps, Splitwise, and email.
• ScamRakshak — On-Device AI Scam Detector — Indians lose thousands of crores annually to digital scams via WhatsApp, SMS, and social media.
• PaisaGuard — Family Budget Survival App — Middle-class families worldwide track expenses inconsistently — UPI apps show transactions but don't enforce budgets.
• rohitraj.tech — Engineering work is often invisible.
• Agent Autopsy — Forensic Debugger for Failed AI Agent Runs — Most AI agent failures are silent — the run completes, the status code is green, and the result is still wrong.
• tinyvoice — Fine-Tune a Model in Your Own Voice in an Afternoon — Training your own language model sounds like a PhD job that needs a GPU cluster, so most developers never try.
• snap3d — One Photo In, an Editable 3D Model Out — A photo shows you one side of an object; the other five sides are a guess.
• Agentic OS — Force-Directed Map of a 387-Skill Claude Code Setup — An agent setup grows one plugin at a time until it has hundreds of skills, and nobody can see what it actually contains.
• claude-autodev — Autonomous 8-Stage Dev Pipeline for Claude Code — Agentic coding tools stop at a diff.
• KisanSathi — Six AI Farm Experts, Keyless and Local — Farmer-facing AI tools die at the API-key step, answer in English, and hand back generic advice with no live numbers behind it.
• MarginChef — AI Agent That Finds a Restaurant's Margin Leaks — Restaurants run on 3-5% net margins while food costs are up roughly 35% since 2019, and most owners never see per-dish economics.
• Quorum — Deep-Research Agent Swarm with a Shared GraphRAG Brain — Most AI research tools are one model in a loop.
• RegexForge — Plain English to a Regex You Can Trust — Regex is not hard because the syntax is exotic.
• Skillet — Turn Any Docs Page Into an Installable Claude Code Skill — Agent skills are the fastest way to teach a coding agent a new tool, but writing a good SKILL.
• Ladle — Open-Source Prep Forecasting and Food-Cost Leak Detection — Restaurants throw away 4-10% of the food they buy before it reaches a plate, and most owners find out at month end from a food-cost percentage that moved the wrong way, with no idea which ingredient did it.
• Casita — Design Your Home in 3D in the Browser — Home design tools want an install, a login, or a CAD background.
• VoxelForge — A Voxel Sandbox Engine Built Properly — Voxel sandboxes are the demo everyone builds with a coding agent right now, and almost all of them are a throwaway single HTML file that hitches on chunk generation, ships a texture pack, and cannot be read or extended.
• prompt-ocean — Type a Sea, Watch It Exist — Generative interfaces usually hand a model the wheel and hope.
• HEXAPOD — Inverse Kinematics and Gait Simulator — Hexapod gait and leg IK are usually explained with equations and a video, or hidden inside a robotics library.
• avatar-sync — Real-Time Face and Hand Tracking in One HTML File — Face and hand tracking demos come wrapped in a build step, a server, and usually an API key — which puts a wall in front of anyone who just wants to see what the models actually output before building on them.
• TableTalk — Scan, Order, Eat: QR Ordering for Dine-In — Dine-in ordering still means flagging a waiter, squinting at a laminated menu with no photos, and repeating your order across the noise.
• Shoebox — Bill Photo to GST Ledger, Offline — Small shops in India keep supplier bills in a pile until the accountant asks.
• BridgeTrace — Find Where a USDC Transfer Stopped — A USDC transfer between chains can stop at three points: the source burn, Circle's attestation, or the destination receive transaction.
• Reliability & Production Readiness — Load testing, observability, and API contracts.
• Open Source Repos — Browse the source code behind these projects.